CVE-2026-78947: Google Chrome Auth Bypass Vulnerability

CVE-2026-78947 Overview

CVE-2026-78947 is an incomplete cleanup vulnerability [CWE-459] in Google Chrome versions prior to 152.0.7977.65. The flaw allows a remote attacker to bypass the web origin policy through a crafted Chrome extension. Exploitation requires user interaction and depends on social engineering to install the malicious extension. Chromium classifies the underlying security severity as Low, while the National Vulnerability Database (NVD) assigns a medium rating based on the impact to integrity across web origins.

Critical Impact
A crafted Chrome extension can bypass same-origin protections, enabling cross-origin data manipulation and integrity violations against websites the victim visits.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable extension cleanup logic
Downstream browser vendors that pull from the affected Chromium branch

Discovery Timeline

2026-08-25 - CVE-2026-78947 published to the NVD
2026-08-27 - Last updated in the NVD database

Technical Details for CVE-2026-78947

Vulnerability Analysis

The vulnerability is an incomplete cleanup issue [CWE-459] in Chromium's handling of extension-scoped resources. When Chrome fails to fully release or reset state associated with an extension context, residual references remain accessible. An attacker who convinces a user to install a crafted extension can leverage this residual state to reach content or capabilities across web origins that should be isolated.

Because the flaw undermines origin isolation, a successful attack can modify data displayed or submitted through targeted sites. The Common Vulnerability Scoring System (CVSS) impact vector reflects a high integrity effect with no direct confidentiality or availability loss. User interaction is required to install or approve the malicious extension, which places social engineering on the exploitation path.

The Exploit Prediction Scoring System (EPSS) currently reports a low probability of exploitation activity, and no public proof-of-concept has been released. Google resolved the issue in Chrome Stable 152.0.7977.65.

Root Cause

The root cause is incomplete cleanup of state tied to a Chrome extension. Objects, permissions, or references that should have been released remain reachable, allowing extension code to interact with content bound to a different web origin. This violates the browser's origin isolation model.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker distributes a crafted extension, typically through social engineering, and induces the victim to install it. Once installed, the extension abuses the incomplete cleanup path to operate outside the origin scope granted to it. The vulnerability manifests entirely on the client side; no direct authentication against a target service is required. See the Chromium Issue Tracker #523313378 for further technical context.

Detection Methods for CVE-2026-78947

Indicators of Compromise

Installation of Chrome extensions from sources outside the Chrome Web Store or from newly registered publishers.
Extensions requesting broad host permissions such as <all_urls> shortly before anomalous cross-site activity.
Browser telemetry showing unexpected script execution against sites the user did not initiate navigation to.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved allowlist.
Correlate browser process creation events with recent extension installs and Chrome versions below 152.0.7977.65.
Alert on modifications to the Chrome Extensions and Preferences files in user profile directories.

Monitoring Recommendations

Ingest Chrome management events and extension install logs into your security data lake for retrospective search.
Monitor for Chrome versions in the fleet that remain below the patched build after the vendor advisory date.
Track outbound requests originating from extension background service workers to unfamiliar domains.

How to Mitigate CVE-2026-78947

Immediate Actions Required

Update all Chrome installations to 152.0.7977.65 or later using the vendor's Stable Channel release.
Enforce enterprise extension allowlists through the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies.
Audit currently installed extensions and remove any that are unnecessary or from untrusted publishers.
Communicate a user awareness reminder covering the risks of installing extensions delivered through social engineering.

Patch Information

Google released the fix in Chrome Stable 152.0.7977.65. Details are available in the Google Chrome Stable Update advisory. Chromium-based browsers should be updated once their vendors publish builds incorporating the corrected cleanup logic.

Workarounds

Block extension installation for standard users via the ExtensionInstallBlocklist policy set to * and explicit allowlists for approved IDs.
Restrict Chrome to force-installed extensions through the ExtensionInstallForcelist policy.
Disable developer mode extensions through the DeveloperToolsAvailability and ExtensionDeveloperModeSettings policies until patching completes.

bash

# Configuration example: enterprise policy JSON to restrict Chrome extensions
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "aapocclcgogkmnckokdopfmhonfmgoek",
    "ghbmnnjooekpmoecnnnilnnbdlolhkhi"
  ],
  "ExtensionInstallForcelist": [],
  "DeveloperToolsAvailability": 2
}